1. Field of the Invention
The present invention relates to data security. More particularly, the present invention relates to a wireless authentication system which mitigates the likelihood of unauthorized use of an electronic device through periodic challenge/response messages.
2. Description of Art Related to the Invention
As personal computers ("PCs") become more prevalent in businesses throughout the world, it is becoming increasingly important to provide security to prevent their unauthorized use. Already, there exist a number of authentication systems which provide marginally effective security of one's personal computer. For example, one well-known type of conventional authentication system is a "password-based" system in which a person is allowed access to the contents of and resources networked to a personal computer by correctly typing in a previously chosen password. However, password-based systems are susceptible to (i) software which can be used to capture the person's password and to (ii) common "human" mistakes such as confiding one's password to another or using the same password for a long period of time. Moreover, password-based systems do not provide any mechanism for mitigating the risk of unauthorized use of one's personal computer in those situations where the user fails to turn-off his or her personal computer before leaving work or has to leave his or her office for a moment (e.g., lunch, attend a meeting, etc.) but leaves his or her personal computer running i.e., in an operational state.
Another example is a password protected screen saver which automatically turns off one's computer if it is not used for a predetermined period of time. This authentication system is usually disruptive to the user because its state is dependent on whether or not the user is using the computer, not the proximity of the user to the computer. Thus, if the user is on the phone for a while, the computer may be mistakenly turned off requiring the user to log-in again. Thus, users commonly set the "time-out" of the screen saver for a long duration which defeats its objective to protect the contents of the computer when the user has left his or her office without turning off the computer.
Another marginally effective authentication system is a "card-based" system in which a "smartcard" card being an integrated circuit carried in a credit card form factor, PCMCIA card or magnetic stripped card (hereinafter generally referred to as "token cards") is used to gain physical and/or electrical access to the personal computer. Normally, token cards may be either inserted into a designated card slot of the personal computer, placed in physical contact with a reading device coupled to the computer or placed in an area where the personal computer resides (e.g., an office, laboratory and the like). These token cards are used to verify that the person in possession of the card is in fact authorized to use the personal computer. Depending on the type of token card, such verification is accomplished by the token card responding to a request (i.e., "Challenge message") for information by providing a "token" (i.e. code), normally a random number although it may be static, in response to the challenge issued by the personal computer. In the case of a more sophisticated token card, this request will be in the form of a random "challenge" which the token card must first process in order to provide the correct "response". Although this type of authentication system arguably provides greater security than the password-based system, it still does not solve the problem where the user accesses his or her personal computer and leaves the personal computer unattended for some duration without removing the card or disabling the personal computer during his or her absence.
Hence, it is desirable to develop a wireless authentication system which does not require a physical connection to the personal computer, thereby mitigating the chances of mistakenly leaving one's token card within or in proximity of one's computer. While there now exist some authentication systems in the marketplace such as those provided by Security Dynamics, Inc. of Cambridge, Mass. and Digital Pathways of Mountain View, Calif., their systems do not utilize periodic Challenge/Response protocol to ascertain whether the authorized user of the personal computer has left his or her personal computer unattended for a predetermined period of time.